SPLK-1002 Hard Questions — 25 Difficult Questions

Question 1

A lookup definition is correctly configured, but when used in a search, no results are returned. The lookup file exists and contains data. What is the most likely cause?

Accepted Answer

The lookup definition has the wrong case sensitivity setting.. The lookup definition's case sensitivity setting controls whether the lookup matches field values exactly as they appear in the lookup file. If the definition is set to case-sensitive but the search field values differ in case from the lookup file, no matches will occur. This is the most likely cause when the lookup file exists, contains data, and the definition is otherwise correctly configured.

Answer

The lookup file has too many fields.

Answer

The lookup file is in JSON format but the definition expects CSV.

Answer

The search time field extraction for the matching field is disabled.

Question 2

A Splunk environment ingests 10 TB per day. A user runs a search to count events per sourcetype over the last 7 days: `index=* earliest=-7d | timechart count by sourcetype`. The search returns partial results and eventually times out. The user needs to obtain the complete results efficiently. What is the best course of action?

Accepted Answer

Use `| tstats count where index=* earliest=-7d by _time span=1d, sourcetype` and then format as needed.. `tstats` runs on indexed metadata (tsidx files) rather than raw events, making it far more efficient for counting events over large time ranges. By specifying `by _time span=1d, sourcetype`, you get daily counts per sourcetype without scanning the entire event data, avoiding the timeout that occurs with a raw search over 10 TB/day for 7 days.

Answer

Use `| bucket span=1d | stats count by _time sourcetype` then `| xyseries` to format.

Answer

Use `| sitime` to sample the data and approximate counts.

Answer

Break the search into 1-day intervals and use `append` to combine results.

Question 3

Refer to the exhibit. An administrator is configuring a CIDR match lookup for geo-IP. The lookup is not working. What is most likely the issue?

Accepted Answer

The match_type should be 'match_type = cidr' without brackets. In transforms.conf, the CIDR match lookup requires the setting 'match_type = cidr' to be written as a proper key-value pair. The exhibit shows the value wrapped in brackets (e.g., '[cidr]'), which Splunk interprets as a literal value rather than the CIDR matching mode, so the lookup falls back to default exact-match behavior and never matches IP ranges. Removing the brackets so the stanza reads 'match_type = cidr' enables CIDR-based matching against the lookup file.

Answer

The max_matches setting should be 0

Answer

The filename should include the full path

Answer

The stanza name should be 'geo_ip' without brackets

Question 4

A search uses `transaction maxspan=30s maxpause=5s`. Events are sorted by _time. If there is a gap of 10 seconds between two events, what happens?

Accepted Answer

They are split into separate transactions because the gap exceeds maxpause.. The `maxpause` parameter in the `transaction` command defines the maximum allowed gap between consecutive events within the same transaction. Since the gap of 10 seconds exceeds the `maxpause=5s`, the events are split into separate transactions, regardless of the `maxspan=30s` limit. The `maxspan` only sets an upper bound on the total duration of the transaction from the first to the last event, but it does not override the pause-based splitting logic.

Answer

They are merged because maxpause is 5s but maxspan is 30s, so the 10s gap is within maxspan.

Answer

They are considered part of the same transaction as long as total span ≤ 30s.

Answer

They are split only if the total span exceeds maxspan.

Question 5

A search returns events with fields 'user', 'action', and 'count'. The analyst wants to create a timechart showing the number of distinct users performing 'login' actions per hour. Which search is correct?

Accepted Answer

`... | timechart span=1h dc(user)`. `timechart span=1h dc(user)` computes the distinct count of the 'user' field per 1-hour time bucket, which directly answers the requirement of showing the number of distinct users performing 'login' actions per hour. The `dc()` function in Splunk is the distinct count function, and `timechart` automatically groups events by `_time` into the specified span.

Answer

`... | stats dc(user) by _time span=1h`

Answer

`... | timechart span=1h dc(by user)`

Answer

`... | eval user=user | timechart span=1h count by user`

Answer

`... | timechart span=1h sum(count) by user`

Question 6

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

Accepted Answer

The field name in the CSV header is 'User_ID' (capital U), while the event field is 'user_id' (lowercase). Splunk field matching is case-sensitive.. Splunk lookups are case-sensitive when matching field values. The exhibit shows the CSV header uses 'User_ID' (capital U), while the search references 'user_id' (lowercase). Since the lookup field name in the definition must exactly match the event field name, the mismatch causes the lookup to fail, returning 'UNKNOWN' for all events even when the user_id exists in the CSV.

Answer

The lookup file is not distributed to all indexers.

Answer

The match_type is not specified, defaulting to EXACT, but the CSV contains case variations.

Answer

The max_matches should be set to 0.

Answer

The lookup definition is missing the default_match setting, which should be set to 'no_match'.

Question 7

A security analyst needs to create a lookup that returns a severity level based on a combination of two fields: src_ip and dest_port. The lookup file ports.csv has columns src_ip, dest_port, and severity. Which lookup configuration correctly matches events using both fields?

Accepted Answer

Define a lookup with lookup key src_ip and dest_port, leaving match_type as the default (exact).. A lookup can use multiple fields as lookup keys. When match_type is exact (the default), Splunk requires all specified event fields to match the corresponding lookup columns. Defining lookup keys src_ip and dest_port ensures that severity is returned only when both fields match a row in ports.csv, providing accurate multi-field enrichment.

Answer

Create two separate lookups, one for src_ip and one for dest_port, and use the lookup command twice.

Answer

Define a lookup with lookup key src_ip and dest_port, and set match_type to CIDR(src_ip).

Answer

Define a lookup with lookup key src_ip only and set match_type to CIDR(src_ip), then use where severity>0.

Question 8

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

Accepted Answer

Set Alert Type to 'Per Result' to trigger an alert for each matching event.. Setting the Alert Type to 'Per Result' ensures that an alert is triggered for each matching event in the search results. In a multi-search head environment, the saved search runs on all search heads, potentially causing duplicate alerts. However, to achieve a single alert per triggered result, you must first enable per-result alerting. Options such as throttling or using a dedicated search head can then be used to deduplicate. Option B (Alert Suppression) suppresses consecutive identical alerts from the same search, which does not address cross-head duplication. Options A and D are unrelated to the alerting mechanism. Therefore, C is the key setting among the choices.

Answer

Set the time range to 'Real-time' to capture events as they happen.

Answer

Enable 'Alert Suppression' to suppress duplicate alerts.

Answer

Set the Schedule to 'Continuous' to avoid duplicates.

Question 9

A Splunk admin wants to track the number of unique users who accessed a system each hour over the past 24 hours. Which search provides the correct result?

Accepted Answer

index=main earliest=-24h | timechart span=1h dc(user) as unique_users. It uses `timechart span=1h dc(user)` to count distinct users per hour over the last 24 hours. The `dc()` function calculates distinct counts, and `span=1h` sets the time bucket to one hour, exactly matching the requirement.

Answer

index=main earliest=-24h | timechart span=1h values(user)

Answer

index=main earliest=-24h | stats dc(user) by _time | timechart span=1h dc(user)

Answer

index=main earliest=-24h | timechart span=1h count by user

Question 10

A security team wants to detect a multi-step attack pattern: a user logs in from a new IP address, then within 10 minutes performs a privilege escalation, and finally accesses a sensitive file. They have events with fields: user, ip, action, and timestamp. Which SPL transaction statement should they use to group these three events into one transaction, ensuring all three actions occur in order?

Accepted Answer

`transaction user maxspan=10m`. `transaction user maxspan=10m` groups all events from the same user that occur within a 10-minute window. The events are inherently ordered by timestamp, so the three actions (login, privilege escalation, sensitive file access) will appear in chronological order within the transaction, satisfying the requirement. Including `action` or `ip` in the transaction fields would split the three different actions or IP addresses into separate transactions, preventing detection of the complete pattern.

Answer

`transaction user,ip,action maxspan=10m`

Answer

`transaction user maxpause=30s`

Answer

`transaction user mvcount=3`

Question 11

Refer to the exhibit. A search uses the macro as `| `fillnull(field=user)`. However, the search fails with a syntax error. What is the most likely issue?

Accepted Answer

The macro definition contains unescaped commas. The macro definition likely contains unescaped commas, which Splunk interprets as argument separators, causing a syntax error when the macro is invoked with a single argument. In Splunk, commas in macro definitions must be escaped with a backslash.

Answer

The macro argument should be passed without the `field=` prefix

Answer

The macro definition should use positional arguments instead of named

Answer

The macro definition should include a pipe before `eval`

Question 12

A security analyst is using a lookup table to enrich IP addresses with threat intelligence. Which THREE statements about lookups are true?

Accepted Answer

Lookups can be used to add fields from an external source. Option A is correct because a lookup's core purpose is to enrich events by pulling in additional fields from an external source (CSV, KV store, or a lookup definition) and appending them to the search results. Option D is correct because automatic lookups are defined in props.conf, where you specify the lookup name, the input field(s), and the output field(s) so the enrichment happens at search time without an explicit lookup command. Option E is correct because lookups can be backed by CSV files (file-based lookups) or by KV store collections (KV store lookups), both of which are valid lookup types in Splunk. Option B is wrong because lookups also support CIDR and wildcard matching, not just exact match. Option C is wrong because lookup data does not need to be indexed; it is referenced at search time from a file or KV store collection.

Answer

Lookups can only be used with exact match

Answer

Lookups require the data to be indexed in Splunk

Question 13

A team uses a large index with many sourcetypes. They want to identify categories of events that have at least 100 occurrences, compute the average response_time per category, and return the top 5 categories with the highest average response_time. Which search best optimizes performance?

Accepted Answer

index=main | stats avg(response_time) as avg, count as cnt by category | where cnt>=100 | sort -avg | head 5. It uses a single stats command to compute both avg(response_time) and count (cnt) by category, then filters, sorts, and limits the results efficiently. Option A uses eventstats followed by stats—this is less efficient and the avg field is lost after stats count, making the sort invalid. Option B uses the top command, which does not compute the correct average and may not properly enforce the count threshold across all categories. Option C computes avg by category but omits the count, so the where cnt>=100 condition will fail.

Answer

Answer

index=main | top category | eval avg=avg(response_time) | where count>=100

Answer

index=main | stats avg(response_time) as avg by category | where cnt>=100 | sort -avg | head 5

Question 14

A developer needs to calculate the 95th percentile of response times for each service over the past hour. The data has fields: service, response_time. Which search achieves this correctly and efficiently?

Accepted Answer

`index=main | stats perc95(response_time) by service`. `stats perc95(response_time) by service` directly calculates the 95th percentile for each service across all events in one efficient pass. It is the simplest and most efficient way. Option C, while producing the same result, is less efficient because it first appends the percentile to every event using `eventstats` and then collapses with `stats values()`, adding unnecessary overhead. Option B uses time-based bucketing and option D uses a running calculation, both of which do not produce the desired overall percentile.

Answer

`index=main | timechart perc95(response_time) by service`

Answer

`index=main | eventstats perc95(response_time) as p95 by service | stats values(p95) as p95 by service`

Answer

`index=main | streamstats perc95(response_time) as p95 by service | stats latest(p95) as p95 by service`

Question 15

A company uses `transaction` to group events by `order_id`. Some orders have many events (1000+). Which option should be added to prevent a single transaction from consuming too many resources?

Accepted Answer

maxevents=500. Adding maxevents=500 to the transaction command limits each transaction to a maximum of 500 events, preventing any single transaction from consuming excessive resources. This directly addresses the concern of orders with 1000+ events by capping the transaction size while still grouping events by order_id. It is the most appropriate option for resource control.

Answer

keepevicted=true

Answer

maxspan=1h

Answer

maxpause=5m

Question 16

A Splunk admin notices that a time-based lookup (defined in transforms.conf with time_range=TRUE) is not returning correct results for events outside the lookup's time boundaries. The lookup file contains rows with a valid time range. What is the most likely cause?

Accepted Answer

The event time is outside the time range defined in the lookup. When a time-based lookup is configured with time_range=TRUE in transforms.conf, Splunk restricts lookup matches to events whose timestamps fall within the time range specified in the lookup file. If an event's timestamp is outside that range, the lookup will not return any results, even if other fields match. This is the most likely cause because the question explicitly states that events are outside the lookup's time boundaries.

Answer

The lookup is defined as an automatic lookup and runs at index time

Answer

The lookup table has max_matches set to 1, limiting matches

Answer

The lookup file does not contain a time field

Question 17

An organization has a transaction that groups firewall events by source IP to detect port scans. The transaction uses `maxpause=1m`. Some valid scans are being missed because events occasionally have gaps longer than 1 minute due to network latency. Which change would best capture these scans without introducing too many false positives?

Accepted Answer

Increase maxpause to 2 minutes. Increasing maxpause to 2 minutes allows the transaction to tolerate longer gaps between events caused by network latency, ensuring that valid port scans are still captured. This change directly addresses the issue without altering the grouping logic or removing the timeout guard, which would otherwise risk false positives or incorrect grouping.

Answer

Decrease maxspan to 30 seconds

Answer

Remove maxpause and use only maxspan

Answer

Group by destination IP instead of source IP

Question 18

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

Accepted Answer

Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.. The 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Answer

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Answer

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Answer

Reduce the search time window to 5 minutes to decrease execution time.

Question 19

A large CSV lookup file (over 10 million rows) is causing search performance degradation. Which solution best improves performance without sacrificing accuracy?

Accepted Answer

Convert to a KV Store lookup and update the collection as needed. Converting the large CSV lookup to a KV Store lookup improves performance because KV Store uses an indexed, persistent database (backed by MongoDB) that supports efficient key-based lookups, unlike CSV lookups which are loaded into memory and linearly scanned. KV Store lookups can handle large datasets without the memory pressure and replication overhead that CSV files impose on search heads. Accuracy is preserved because the full dataset remains available and queryable.

Answer

Increase the max_memory setting in transforms.conf

Answer

Convert to an index-time lookup with automatic re-indexing

Answer

Reduce the CSV file to only the most common lookup keys

Question 20

Which THREE conditions must be met for events to be grouped into the same transaction when using the 'transaction' command without any 'startswith' or 'endswith' options? (Choose three.)

Accepted Answer

Events must have the same value in the field specified by the 'by' clause.. When the transaction command is used without startswith or endswith, grouping is driven by the by clause, maxspan, and maxpause. Option A is correct because events are only grouped together if they share the same value in the field named by the by clause, which defines the transaction boundaries. Option B is correct because maxspan sets the maximum allowed time between the first and last event in a transaction, so the total span must not exceed that value. Option D is correct because maxpause limits the maximum time gap between consecutive events, and any larger gap breaks the transaction. Option C is not required, since transactions can span different sourcetypes as long as the by, maxspan, and maxpause conditions are satisfied. Option E is not required, because Splunk assigns timestamps to events and does not require a special chronological or no-missing-timestamp condition for transaction grouping.

Answer

Events must be from the same sourcetype.

Answer

Events must appear in chronological order with no missing timestamps.